PT-2026-27191 · Avideo · Avideo

Restriction · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-33717

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The downloadVideoFromDownloadURL() function in objects/aVideoEncoder.json.php saves remote content to a web-accessible temporary directory using the original URL's filename and extension, including .php. Providing an invalid resolution parameter triggers an early die() via forbiddenPage() before the temporary file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at videos/cache/tmpFile/. The function forbiddenPage() is involved in the process.

Recommendations Versions prior to and including 26.0 should be updated to a version containing commit 6da79b43484099a0b660d1544a63c07b633ed3a2. As a temporary workaround, restrict access to the objects/aVideoEncoder.json.php file.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-33717

GHSA-8WF4-C4X3-H952

Produtos afetados

Avideo

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33717.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952 · Aviso do Fabricante
• https://github.com/WWBN/AVideo/commit/6da79b43484099a0b660d1544a63c07b633ed3a2 · Correção
• https://osv.dev/vulnerability/CVE-2026-33717 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33717 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2036166982597280070 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-8wf4-c4x3-h952 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2036160673982620115 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2036189941856715066 · Publicação no Twitter